Security audit

Smart Search

Security checks for vulnerabilities and agentic risk

Overview

This search skill has a legitimate purpose, but its scripts and metadata understate risky execution, credential, Docker, and persistence behavior.

Install only after reviewing the shell scripts. Avoid using sensitive queries unless SearX is definitely local and available, do not run deploy-searx.sh on a shared or Internet-reachable host without changing the bind address to loopback and disabling persistence, and do not place secrets in ~/.openclaw/.env unless you accept that this skill sources that file as shell code.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: search.sh:23
Finding: Arbitrary Python Code Execution Through Unvalidated MAX_RESULTS
Content: View full analysis
Remediation: View remediation
&2 exit 2 fi if (( MAX_RESULTS < 1 || MAX_RESULTS > 100 )); then echo "MAX_RESULTS must be between 1 and 100" >&2 exit 2 fi ``` 2. Never interpolate the value into Python source. Pass it as a positional argument: ```bash python3 - "$MAX_RESULTS" <<'PY' import json import sys max_results = int(sys.argv[1]) data = json.load(sys.stdin) results = data.get("results", [])[:max_results] PY ``` 3. Move the Python logic into a static `.py` file or a single-quoted heredoc. 4. Add regression tests using quotes, semicolons, newlines, Python expressions, negative values, and oversized integers. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: search.sh:27
Finding: Arbitrary Shell Execution by Sourcing the Shared OpenClaw Credential File
Content: View full analysis
/dev/null || export $(cat ~/.openclaw/.env | grep -v '^#' | xargs) fi ``` ### Technical Analysis A shell `.env` file is not merely read by `source`; it is executed as Bash code. Functions, command substitutions, redirections, external commands, and other shell constructs in `~/.openclaw/.env` therefore execute whenever the Skill runs. The Skill requires only `SEARXNG_URL` and `TAVILY_API_KEY`, but it processes the entire shared OpenClaw environment file. This exceeds minimum privilege by importing unrelated variables and secrets into the process. The fallback is also unsafe because it performs unquoted expansion and word splitting. It does not correctly support general dotenv syntax and can interpret malformed entries as arguments to `export`. ### Attack Path 1. Another local process, compromised plugin, installer, or user gains write access to `~/.openclaw/.env`. 2. It inserts a shell command into the file. 3. The user invokes `search.sh`. 4. The `source` statement executes the injected command with the invoking user’s privileges. 5. The command can access the Skill process environment, local files, and network. This path does not require compromising Exa, Tavily, or SearX because execution occurs before the search request. ### Impact Assessment Successful exploitation allows arbitrary shell command execution as the invoking user. It may expose every credential stored in the shared `.env`, not only the Tavily key. Potential scope includes: - Credential theft. - Workspace modification. - Destructive file operations. - Additional process or service creation. - Network-based data exfiltration. - Compromise of other tools that trust the same user account. ]]>
Remediation: View remediation

T06 · System Persistence

Error

Location: deploy-searx.sh:154
Finding: SearX Deployment Creates a Cross-Session Persistent Docker Service
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: deploy-searx.sh:67
Finding: SearX Is Published on All Host Interfaces Without Rate Limiting
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: search.sh:270
Finding: Configurable SearX URL Enables Query Exfiltration and Internal Request Redirection
Content: View full analysis
/dev/null) if echo "$RESPONSE" | grep -q '"results"'; then echo "$RESPONSE" return 0 else return 1 fi } ``` ### Technical Analysis `SEARXNG_URL` is trusted without validating its scheme, hostname, port, or resolved address. The metadata declares `http://localhost:8080`, but runtime behavior permits arbitrary destinations. This is especially significant because the routing logic intentionally sends privacy-sensitive queries to SearX. If the environment value is modified, those queries can instead be sent to an attacker-controlled server. The query is not properly URL encoded. Replacing spaces with `+` does not encode `&`, `#`, `?`, percent sequences, control characters, or other reserved characters, allowing the query to alter URL parameters or request interpretation. ### Attack Path 1. An attacker or compromised local component modifies `SEARXNG_URL` in the process environment or shared `.env`. 2. The user submits a query classified as private or explicitly requests SearX. 3. `search.sh` constructs a URL using the attacker-controlled base address. 4. `curl` sends the query to the attacker’s server or another unintended internal endpoint. 5. The destination records the sensitive query and returns a response containing `"results"` so that the request appears successful. ### Impact Assessment This can disclose search terms involving passwords, medical conditions, legal issues, financial matters, personal information, or local configuration—the exact classes that the Skill claims to protect ...[truncated 288 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: search.sh:243
Finding: Search Inputs Are Interpolated Into JSON Without Escaping or Type Validation
Content: View full analysis
/dev/null) ``` ```bash RESPONSE=$(curl -s -X POST https://api.tavily.com/search \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -m 15 \ -d "{\"query\": \"$QUERY\", \"max_results\": $MAX_RESULTS, \"include_answer\": true}" 2>/dev/null) ``` ### Technical Analysis `QUERY` is inserted into JSON string literals without JSON escaping. Quotes, backslashes, control characters, and line breaks can invalidate the document or alter its structure. `MAX_RESULTS` is also inserted as raw JSON syntax without enforcing that it is an integer. An attacker can therefore inject additional JSON tokens or fields where the receiving parser accepts the resulting document. Although the requests target fixed Exa and Tavily endpoints, local input can influence more than the intended query value and result count. ### Attack Path 1. An attacker controls or influences the query or second argument. 2. The attacker includes JSON delimiters, escaped characters, or additional object members. 3. The shell interpolates the input into the request body. 4. The external service receives malformed or attacker-shaped JSON. 5. Depending on parser behavior, the service rejects the request, interprets additional fields, or applies modified argument values. ### Impact Assessment Likely consequences include: - Search request denial of serv ...[truncated 391 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: _meta.json:30
Finding: Security Metadata Materially Understates Filesystem Writes, Docker Control, and Persistence
Content: View full analysis
"$CONFIG_DIR/settings.yml" << 'EOF' ``` ```bash docker run -d \ --name searx \ -p "$PORT":8080 \ -v "$CONFIG_DIR:/etc/searx:rw" \ --restart unless-stopped \ searx/searx:1.1.0-69-75b859d2 ``` ### Technical Analysis The Skill is declared read-only and nonpersistent, but its documented deployment script creates a directory, writes configuration, creates and removes Docker containers, mounts a writable host directory, exposes a host port, and installs a restart policy. Security metadata is an important authorization and review boundary. Understating behavior can cause users or automated systems to approve capabilities they would otherwise reject. ### Attack Path 1. A reviewer or user relies on `_meta.json` to assess required permissions. 2. The Skill is approved under the belief that it reads workspace files only and creates no persistence. 3. The user follows the included SearX deployment instructions. 4. The script writes host files, controls Docker, publishes a port, and creates a persistent service. 5. Host state remains changed after the Skill invocation. ### Impact Assessment The discrepancy can result in uninformed authorization of: - Filesystem writes. - Docker daemon access. - Container c ...[truncated 263 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (95)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The recovery instructions tell users to delete the local configuration directory with rm -rf ~/searx-config without any warning or validation step. If users have customized settings or if the path is misunderstood or expanded unexpectedly, this can permanently destroy local configuration and break the service.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: rm -rf ~/searx-config permanently deletes the local configuration directory without confirmation, making accidental destructive execution likely. Because this is in operational guidance for general users, the skill context makes it more dangerous: readers are encouraged to run commands directly rather than reason about their safety.
Content: Scanner excerpt · README.searx.md (reported line 315)May include surrounding context.
恢复配置

bash
docker stop searx rm -rf ~/searx-config cp -r ~/searx-config.backup.20260326 ~/searx-config docker start searx

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: rm -rf ~/searx-config permanently deletes the local configuration directory without confirmation, making accidental destructive execution likely. Because this is in operational guidance for general users, the skill context makes it more dangerous: readers are encouraged to run commands directly rather than reason about their safety.
Content: Scanner excerpt · README.searx.md (reported line 315)May include surrounding context.
恢复配置

bash
docker stop searx rm -rf ~/searx-config cp -r ~/searx-config.backup.20260326 ~/searx-config docker start searx

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY.md (reported line 99)May include surrounding context.
检查命令：

bash
grep -E "(rm -rf|sudo|chmod 777|curl.*\|.*sh|eval|exec)" *.sh

结果：

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY_AUDIT.md (reported line 37)May include surrounding context.
检查命令：

bash
grep -E "(rm -rf|sudo|chmod 777|curl.*\|.*sh|eval|exec)" *.sh

结果：

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY_AUDIT.md (reported line 43)May include surrounding context.
检查命令：

bash
grep -E "(rm -rf|sudo|chmod 777|curl.*\|.*sh|eval|exec)" *.sh

结果：

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes very broad everyday terms such as 'write,' 'latest,' and 'deep,' which can cause the skill to activate unintentionally in unrelated conversations. Because the skill routes prompts to external search providers, accidental invocation can leak user content or sensitive context to third parties without clear intent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims zero configuration and no API key requirements while also depending on local environment configuration and optional third-party credentials for advertised features. Misrepresenting credential use and outbound access can cause users to expose secrets or enable network behavior they did not knowingly approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims zero configuration and no API key requirements while also depending on local environment configuration and optional third-party credentials for advertised features. Misrepresenting credential use and outbound access can cause users to expose secrets or enable network behavior they did not knowingly approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims zero configuration and no API key requirements while also depending on local environment configuration and optional third-party credentials for advertised features. Misrepresenting credential use and outbound access can cause users to expose secrets or enable network behavior they did not knowingly approve.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
./deploy-searx.sh

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: Storing an API key in a local .env file is common, but the guide presents it without any guidance on file permissions, secret management, or avoiding accidental exposure. In an agent-skill environment, poorly protected credentials can be read by other local processes, backups, or users if the file is not secured.
Content: Scanner excerpt · TAVILY_SETUP.md (reported line 49)May include surrounding context.
4️⃣ 配置到环境变量

bash
# 编辑配置文件 nano ~/.openclaw/.env # 添加（或替换）以下行 TAVILY_API_KEY=tvly-your-actual-key-here

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The instruction to run 'cat ~/.openclaw/.env | grep TAVILY' encourages full plaintext disclosure of the configured secret. This can expose the API key in terminal scrollback, screen recordings, remote support sessions, shell tooling, or logs, making credential theft substantially easier.
Content: Scanner excerpt · TAVILY_SETUP.md (reported line 127)May include surrounding context.
检查：

bash
# 查看配置的 Key cat ~/.openclaw/.env | grep TAVILY # 测试 API curl -X POST https://api.tavily.com/search \

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The recommendation to maintain multiple API keys in the same .env file for account rotation normalizes bulk secret accumulation and increases blast radius if the file is exposed. It also implicitly promotes quota-workaround behavior, which can lead users to manage more credentials insecurely than necessary.
Content: Scanner excerpt · TAVILY_SETUP.md (reported line 142)May include surrounding context.
Q2: 额度用完了？

方案 A：多账号轮换

bash
# ~/.openclaw/.env TAVILY_API_KEY=tvly-key1 TAVILY_API_KEY_2=tvly-key2 # 第二个账号 TAVILY_API_KEY_3=tvly-key3 # 第三个账号

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The recovery instructions again direct users to place a live API key into a plaintext .env file without accompanying secret-protection guidance. Repetition of unsafe credential-handling patterns increases the chance that operators treat the key as ordinary configuration rather than a sensitive secret.
Content: Scanner excerpt · TAVILY_SETUP.md (reported line 162)May include surrounding context.
恢复方法：

bash
# 重新编辑 nano ~/.openclaw/.env # 添加 API Key TAVILY_API_KEY=tvly-your-key

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · deploy-searx.sh (reported line 180)May include surrounding context.
sh
echo " curl \"http://localhost:$PORT/search?q=test&format=json\"" echo "" echo "⚙️ 配置 smart-search：" echo " 编辑 ~/.openclaw/.env" echo " 添加：SEARXNG_URL=http://localhost:$PORT" echo "" echo "📚 管理命令："

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 30)May include surrounding context.
md
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.searx.md (reported line 62)May include surrounding context.
md
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.en.md (reported line 96)May include surrounding context.
md
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.en.md (reported line 103)May include surrounding context.
md
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
md
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · search.sh (reported line 8)May include surrounding context.
sh
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · search.sh (reported line 27)May include surrounding context.
sh
# 🔒 安全声明： # - 仅发送搜索查询到 Exa/Tavily 官方服务 # - 不收集、存储、上传任何用户数据 # - API Key 从本地 .env 读取，绝不传输 # - 代码开源可审查，无混淆无隐藏逻辑 # # 🛡️ 安全审计：Benign（良性）

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The comments explicitly claim API keys are 'never transmitted', but the Tavily request sends TAVILY_API_KEY in an Authorization header to a remote service. This can mislead users into exposing credentials under false assurances and undermines informed consent about network data flows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T06 · System Persistence

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Tool Parameter Abuse

恢复配置

Tool Parameter Abuse

恢复配置

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Vague Triggers

Tp4

Tp4

Tp4

Ae1

Credential Access

4️⃣ 配置到环境变量

Credential Access

Credential Access

Q2: 额度用完了？

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Intent-Code Divergence

Static analysis